Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what steps the Department is taking to ensure that AI systems used in A&E departments comply with NHS data governance, patient privacy and cybersecurity requirements.

The Government is dedicated to ensuring patient privacy while leveraging artificial intelligence (AI) in healthcare. We have engaged patients and the public in discussions on how and why health data should be accessed for AI systems. The Department and NHS England have implemented robust data protection measures, including Data Protection Impact Assessments and adherence to UK General Data Protection Regulation, to safeguard patient data. All National Health Service trusts and providers must complete a Digital Technology Assessment Criteria (DTAC) assessment to fully assure that the technologies they use are safe, effective, and that data is protected. This includes technologies used in accident and emergency departments. The DTAC evaluates products to ensure NHS standards for safety, usability, and accessibility are met, with clear evidence requirements and scoring criteria included for each area.

The accident and emergency demand forecasting tool, within the NHS England Federated Data Platform, is trained on pseudonymised data, and with only aggregate non-patient level outputs reaching the dashboard users. Regular risk reviews occur to ensure it is as low risk as possible in terms of cyber security and patient privacy and that it follows NHS data governance.

The Department and the NHS England Information Governance Team provide guidance for patients, health care professionals, and information governance professionals on the use of AI in the NHS and NHS settings such as accident and emergency departments.

The Department works closely with the NHS and its suppliers to share threat intelligence on evolving AI cyber threats.